City architects want east-west microsegmentation inside the Libraries tenant and also hard isolation from the Courts tenant. How should those goals be treated?
Select an answer to reveal the explanation.
Short Explanation
Locking rooms inside the Libraries wing is not the same as keeping Courts out of the building. Microseg (later GBP-style policy) shapes east-west inside a tenant; VRFs/VNIs keep tenants apart. You often want both—do not pretend one control does the other's job.
Full Explanation
City architects who want east-west microsegmentation inside Libraries and hard isolation from Courts must treat those as different controls that may coexist. Inter-tenant isolation (separate VRF/VNI boundaries between Libraries and Courts) stops department crossover, while intra-tenant microsegmentation (group policy inside Libraries) shapes which Libraries workloads may talk to each other. One does not erase the need for the other in a civic zero-trust plan.
East-west microsegmentation does not replace separate VRFs between tenants; room locks inside one wing are not a substitute for keeping Courts out of the building. Only GBP tags between Libraries and Courts without VRFs treats tags as optional decoration and weakens hard tenant separation. Microsegmentation inside Libraries does not automatically block Courts prefixes in the underlay; underlay and overlay isolation are different planes.
Exam caveat: do not collapse “microseg” and “tenant isolation” into one buzzword on JN0-683-style questions.
Operational check: verify Libraries and Courts use distinct routing instances/VNIs, then confirm intra-Libraries GBP or filter policy separately; test that Courts prefixes never install in Libraries and that denied Libraries east-west flows fail even when VRF reachability exists.